Make package metadata verification fail closed

[jordancalhoun]

What to build

Make --verify fulfill PR #24's promise to compare the finished package with build information. Verification must obtain and validate identifier and version metadata for both component and distribution packages, and it must fail when required metadata is missing or malformed instead of silently skipping the comparison.

Acceptance criteria

• Component packages are rejected when their identifier or version differs from build information.
• Distribution packages receive an equivalent identifier and version check.
• Missing, malformed, or unparseable package metadata causes verification to fail with an actionable diagnostic.
• Existing signature and Gatekeeper checks continue to run when requested.
• Tests remain hermetic by recording package-tool command construction and using fixture metadata where possible.
• The macOS verification loop exercises successful component and distribution verification.

Blocked by

• None — can start immediately.